How South Africans can combat phishing scams

Email has become an integral part of daily life; however, it also serves as a prime channel for cybercriminals, with phishing scams being one of the most prevalent threats, according to Paul Williams, Country Manager for Southern Africa at Fortinet

Phishing scams are malicious emails designed to trick recipients into revealing sensitive information.

In South Africa, where digital adoption is growing rapidly, the stakes are high.

Williams said that phishing emails exploit human error.

"They often play on fear, urgency, or curiosity to compel victims to act without thinking. Falling victim can result in financial losses, data breaches, or identity theft," Williams said. 

Understanding the anatomy of a phishing email is the first step in protecting yourself therefore, here are five critical clues to identify phishing attempts:

Suspicious sender addresses

Phishing emails often come from addresses that appear legitimate, but have subtle discrepancies and minor variations that are easy to overlook.

For example, an email might appear to come from support@bank.co.za but is actually sent from support@bannk.co.za. 

In South Africa, local businesses and financial institutions are common targets.

Williams said: "Always double-check the sender’s address. If anything seems off, contact the organisation directly through official channels."

Generic greetings

A legitimate email from your bank or service provider will usually address you by name, however, phishing emails will make use of impersonal greetings like “Dear Customer” to cast a wide net.

"Cybercriminals often lack personal details, which is why their messages feel generic. If an email claiming to be from your bank doesn’t address you directly, proceed with caution," Williams explained. 

Urgency or fear tactics

Phishing emails often create a sense of panic to spur immediate action. Common examples include warnings about:

- account closures

- unusual login attempts

- unpaid invoices.

According to Williams in SA, there have been phishing emails impersonating the South African Revenue Service (Sars) with threats of legal action for unpaid taxes. You should always verify these claims independently before clicking on any links or sharing any information.

Suspicious links and attachments

Phishing emails often contain links that appear legitimate but instead will redirect you to fake websites. These sites mimic the look of real ones to harvest credentials while attachments can contain malware.

"Hover over any links to check the URL before clicking. And avoid downloading unsolicited attachments. Local campaigns frequently mimic utility providers or telecommunications companies, making vigilance essential," Williams said.

Poor grammar and formatting

While phishing scams are becoming more sophisticated, many still exhibit obvious red flags including spelling mistakes, inconsistent formatting, or awkward phrasing.

Williams said: "Professional organisations take great care with their communications. If the email looks sloppy, it’s likely a scam."

Protect yourself and your organisation

Here are proactive steps to enhance your security:

- Enable multi-factor authentication (MFA) which can add an extra layer of protection, ensuring that even if the cybercriminal obtains your password, they cannot access your account.

- Regularly update your passwords and use strong, unique passwords. Password managers can help you create and store complex passwords securely.

- Educate yourself and others with cybersecurity awareness training to significantly cut down the risk of falling victim to phishing scams. Employees of companies in particular should be trained to recognise and report suspicious emails.

- Verify before you act which means never clicking on links or providing information without verifying the legitimacy of the email through official channels.

IOL Business